def main(image_path):

    alexnet = mx.gluon.model_zoo.vision.alexnet(pretrained=True)

    # print(alexnet)

    orig = cv2.imread(image_path)[..., ::-1]
    orig = cv2.resize(orig, (224, 224))
    img = orig.copy().astype(np.float32)

    mean = [0.485, 0.456, 0.406]
    std = [0.229, 0.224, 0.225]
    img /= 255.0
    img = old_div((img - mean), std)
    img = img.transpose(2, 0, 1)

    img = np.expand_dims(img, axis=0)

    #array = mx.nd.array(img)

    # advbox demo
    m = MxNetModel(alexnet, None, (-1, 1), channel_axis=1)
    attack = FGSMT(m)
    #attack = FGSM(m)

    # 静态epsilons
    attack_config = {"epsilons": 0.2, "epsilon_steps": 1, "steps": 100}

    inputs = img
    #labels=388
    labels = None

    print(inputs.shape)

    adversary = Adversary(inputs, labels)
    #adversary = Adversary(inputs, 388)

    tlabel = 538
    adversary.set_target(is_targeted_attack=True, target_label=tlabel)

    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        adv = adversary.adversarial_example[0]
        adv = adv.transpose(1, 2, 0)
        adv = (adv * std) + mean
        adv = adv * 255.0
        adv = adv[..., ::-1]  # RGB to BGR
        adv = np.clip(adv, 0, 255).astype(np.uint8)
        cv2.imwrite('img_adv.png', adv)

    else:
        print('attack failed')

    print("fgsm attack done")
Пример #2
0
def main():

    m = graphpipeBlackBoxModel(
        "http://127.0.0.1:9000", (0, 255),
        channel_axis=0)

    #不定向攻击
    attack = LocalSearchAttack(m)

    # R 攻击次数
    # r p 绕定系数
    # t 每次攻击的点数
    # d 搜索半径
    attack_config = {"R": 200,"r":1.4,"p":0.3,"t":5}

    data = np.array(Image.open("mug227.png"))
    data = data.reshape([1] + list(data.shape))
    data = np.rollaxis(data, 3, 1).astype(np.float32)  # channels first
    print(data.shape)

    original_data=np.copy(data)
    # 猫对应的标签 imagenet 2012 对应链接https://blog.csdn.net/LegenDavid/article/details/73335578
    original_label = None
    adversary = Adversary(original_data, original_label)

    logger.info("Non-targeted Attack...")
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():

        print(
                'attack success, original_label=%d, adversarial_label=%d'
                % (adversary.original_label, adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image=np.copy(adversary.adversarial_example)

        adversary_image = np.array(adversary_image[0]).astype("uint8").transpose([1, 2, 0])

        im = Image.fromarray(adversary_image)
        im.save("adversary_image.jpg")


    else:
        print('attack failed, original_label=%d' % (adversary.original_label))

    logger.info("LocalSearchAttack attack done")
def get_adversarial_examples_from_model2():
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 500
    IMG_NAME = 'img'
    LABEL_NAME = 'label'

    #保存对抗样本
    x = []
    y = []

    img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32')
    # gradient should flow
    img.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')

    #logits = mnist_cnn_model(img)
    logits = mnist_mlp_model(img)
    #logits = vgg_bn_drop(img)
    #logits = resnet_cifar10(img,32)

    cost = fluid.layers.cross_entropy(input=logits, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    # use CPU
    place = fluid.CPUPlace()
    # use GPU
    #place = fluid.CUDAPlace(0)
    exe = fluid.Executor(place)

    BATCH_SIZE = 1
    test_reader = paddle.batch(paddle.reader.shuffle(
        paddle.dataset.mnist.test(), buf_size=128 * 10),
                               batch_size=BATCH_SIZE)

    #fluid.io.load_params(
    #    exe, model1_path, main_program=fluid.default_main_program())

    fluid.io.load_params(exe,
                         model2_path,
                         main_program=fluid.default_main_program())

    # advbox demo
    m = PaddleModel(fluid.default_main_program(),
                    IMG_NAME,
                    LABEL_NAME,
                    logits.name,
                    avg_cost.name, (-1, 1),
                    channel_axis=1)
    #attack = FGSM(m)
    attack = FGSMT(m)
    attack_config = {"epsilons": 0.3}
    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        adversary = Adversary(data[0][0], data[0][1])

        # FGSM non-targeted attack
        adversary = attack(adversary, **attack_config)

        # FGSMT targeted attack
        #tlabel = 8
        #adversary.set_target(is_targeted_attack=True, target_label=tlabel)
        #adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (data[0][1], adversary.adversarial_label, total_count))

            adversarial_example = adversary.adversarial_example

            x.append(adversarial_example)
            y.append(data[0][1])

        else:
            print('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("fgsm attack done")

    return x, y
Пример #4
0
def main(image_path):

    # Define what device we are using
    logging.info("CUDA Available: {}".format(torch.cuda.is_available()))
    device = torch.device("cuda" if torch.cuda.is_available() else "cpu")

    orig = cv2.imread(image_path)[..., ::-1]
    orig = cv2.resize(orig, (224, 224))
    img = orig.copy().astype(np.float32)

    mean = [0.485, 0.456, 0.406]
    std = [0.229, 0.224, 0.225]
    img /= 255.0
    img = (img - mean) / std
    img = img.transpose(2, 0, 1)

    img = Variable(
        torch.from_numpy(img).to(device).float().unsqueeze(0)).cpu().numpy()

    # Initialize the network
    #Alexnet
    model = models.alexnet(pretrained=True).to(device).eval()
    #model = models.resnet18(pretrained=True).to(device).eval()

    #print(model)

    #设置为不保存梯度值 自然也无法修改
    for param in model.parameters():
        #print(param)
        #print(param.requires_grad)
        param.requires_grad = False

    #loss_func=nn.CrossEntropyLoss()

    # advbox demo
    m = PytorchModel(model, None, (-1, 1), channel_axis=1)
    attack = FGSMT(m)
    #attack = FGSM(m)

    # 静态epsilons
    attack_config = {"epsilons": 0.2, "epsilon_steps": 1, "steps": 100}

    inputs = img
    #labels=388
    labels = None

    print(inputs.shape)

    adversary = Adversary(inputs, labels)
    #adversary = Adversary(inputs, 388)

    tlabel = 538
    adversary.set_target(is_targeted_attack=True, target_label=tlabel)

    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        adv = adversary.adversarial_example[0]
        adv = adv.transpose(1, 2, 0)
        adv = (adv * std) + mean
        adv = adv * 255.0
        adv = adv[..., ::-1]  # RGB to BGR
        adv = np.clip(adv, 0, 255).astype(np.uint8)
        cv2.imwrite('img_adv.png', adv)

    else:
        print('attack failed')

    print("fgsm attack done")
Пример #5
0
def main(use_cuda):
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 500
    IMG_NAME = 'img'
    LABEL_NAME = 'label'

    img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32')
    # gradient should flow
    img.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')
    logits = mnist_cnn_model(img)
    cost = fluid.layers.cross_entropy(input=logits, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    #根据配置选择使用CPU资源还是GPU资源
    place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace()

    exe = fluid.Executor(place)

    BATCH_SIZE = 1

    test_reader = paddle.batch(paddle.reader.shuffle(
        paddle.dataset.mnist.test(), buf_size=128 * 10),
                               batch_size=BATCH_SIZE)

    fluid.io.load_params(exe,
                         "./mnist/",
                         main_program=fluid.default_main_program())

    # advbox demo
    m = PaddleModel(
        fluid.default_main_program(),
        IMG_NAME,
        LABEL_NAME,
        logits.name,
        avg_cost.name, (-1, 1),
        channel_axis=1,
        preprocess=(-1,
                    2))  # x within(0,1) so we should do some transformation

    attack = CW_L2(m, learning_rate=0.1)
    #######
    # change parameter later
    #######
    attack_config = {
        "nb_classes": 10,
        "learning_rate": 0.1,
        "attack_iterations": 50,
        "epsilon": 0.5,
        "targeted": True,
        "k": 0,
        "noise": 2
    }

    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        adversary = Adversary(data[0][0], data[0][1])

        # CW_L2 targeted attack
        tlabel = 0
        adversary.set_target(is_targeted_attack=True, target_label=tlabel)
        adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (data[0][1], adversary.adversarial_label, total_count))

        else:
            print('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("CW attack done")
Пример #6
0
def main(dirname, imagename):
    """
    Advbox demo which demonstrate how to use advbox.
    """

    image_data = tf.gfile.FastGFile(imagename, 'rb').read()

    session = tf.Session()

    def create_graph(dirname):
        with tf.gfile.FastGFile(dirname, 'rb') as f:
            graph_def = session.graph_def
            graph_def.ParseFromString(f.read())

            _ = tf.import_graph_def(graph_def, name='')

    create_graph(dirname)

    # 初始化参数  非常重要

    session.run(tf.global_variables_initializer())

    #tensorlist=[n.name for n in session.graph_def.node]

    #logger.info(tensorlist)
    #获取softmax层而非logit层
    softmax = session.graph.get_tensor_by_name('softmax:0')

    #获取softmax/logits
    logits = session.graph.get_tensor_by_name('softmax/logits:0')

    x = session.graph.get_tensor_by_name('DecodeJpeg/contents:0')

    y = tf.placeholder(tf.int64, None, name='label')

    cross_entropy = tf.nn.sparse_softmax_cross_entropy_with_logits(
        labels=y, logits=logits)

    #tf.gradients(tf.nn.softmax(self._logits)[:, label], self._input)[0]

    print('!!!!!!!')
    #print(logits[:, 0])
    #print(tf.nn.softmax(logits[:, 0]) )
    #print(x)
    #print(cross_entropy)
    #print(g)
    #print(logits)
    #print(softmax)
    g = session.run(logits, feed_dict={x: image_data})
    print(g)

    g = session.run(softmax, feed_dict={x: image_data})
    print(g)
    #tf.gradients(tf.nn.softmax(self._logits)[:, label], self._input_ph)[0]
    #print(logits[:, 1])
    g = tf.gradients(logits, x)
    print(g)

    g = tf.gradients(softmax, x)
    print(g)

    z = tf.placeholder(tf.int64, None)
    z = 2 * y

    g = tf.gradients(z, y)
    print(g)

    #grads = session.run(g, feed_dict={x: image_data})

    #print(grads)

    # advbox demo
    m = TensorflowPBModel(session,
                          x,
                          y,
                          softmax,
                          cross_entropy, (0, 1),
                          channel_axis=1)

    attack = FGSM(m)
    attack_config = {"epsilons": 0.3}

    #print(x.shape)
    #print(y.shape)

    adversary = Adversary(image_data, None)

    # FGSM non-targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

    print("fgsm attack done")
def main():
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 50
    IMG_NAME = 'img'
    LABEL_NAME = 'label'

    img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32')
    # gradient should flow
    img.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')

    logits = mnist_cnn_model(img)
    #logits = vgg_bn_drop(img)
    #logits = resnet_cifar10(img,32)

    cost = fluid.layers.cross_entropy(input=logits, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    # use CPU
    place = fluid.CPUPlace()
    # use GPU
    #place = fluid.CUDAPlace(0)
    exe = fluid.Executor(place)

    BATCH_SIZE = 1
    test_reader = paddle.batch(paddle.reader.shuffle(
        paddle.dataset.mnist.test(), buf_size=128 * 10),
                               batch_size=BATCH_SIZE)

    fluid.io.load_params(exe,
                         "mnist/",
                         main_program=fluid.default_main_program())

    # advbox demo
    m = PaddleModel(fluid.default_main_program(),
                    IMG_NAME,
                    LABEL_NAME,
                    logits.name,
                    avg_cost.name, (-1, 1),
                    channel_axis=1)
    #attack = FGSM(m)
    attack = FGSMT(m)
    attack_config = {"epsilons": 0.3}
    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        adversary = Adversary(data[0][0], data[0][1])

        # FGSM non-targeted attack
        #adversary = attack(adversary, **attack_config)

        # FGSMT targeted attack
        tlabel = 8
        adversary.set_target(is_targeted_attack=True, target_label=tlabel)
        adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (data[0][1], adversary.adversarial_label, total_count))

            adversarial_example = adversary.adversarial_example
            #print adversarial_example

            #原始数据归一化到(-1,1)之间了 需要还原到(0,255)

            adversarial_example /= 2.
            adversarial_example += 0.5
            adversarial_example *= 255.

            adversarial_example = adversarial_example.astype(np.uint8)

            #print adversarial_example

            adversarial_example = np.reshape(adversarial_example, (28, 28))

            im = Image.fromarray(adversarial_example)

            filename = "original-%d-adversarial-%d-targeted-by-fgsm.jpg" % (
                data[0][1], adversary.adversarial_label)

            im.save("output/" + filename)

        else:
            print('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("fgsmt attack done")
Пример #8
0
def main(modulename, imagename):
    '''
    Kera的应用模块Application提供了带有预训练权重的Keras模型,这些模型可以用来进行预测、特征提取和finetune
    模型的预训练权重将下载到~/.keras/models/并在载入模型时自动载入
    '''

    # 设置为测试模式
    keras.backend.set_learning_phase(0)

    model = ResNet50(weights=modulename)
    #model = InceptionV3(weights=modulename)

    logging.info(model.summary())

    img = image.load_img(imagename, target_size=(224, 224))
    raw_imagedata = image.img_to_array(img)
    raw_imagedata = np.expand_dims(raw_imagedata, axis=0)

    # 'RGB'->'BGR'
    imagedata = raw_imagedata[:, :, :, ::-1]

    #logging.info(raw_imagedata)
    #logging.info(imagedata)

    #logit fc1000
    logits = model.get_layer('fc1000').output

    #keras中获取指定层的方法为:
    #base_model.get_layer('block4_pool').output)
    # advbox demo
    # 因为原始数据没有归一化  所以bounds=(0, 255)  KerasMode内部在进行预测和计算梯度时会进行预处理
    # imagenet数据集归一化时 标准差为1  mean为[104, 116, 123]
    # featurefqueezing_bit_depth featurefqueezing防御算法 提高生成攻击样本的质量 为特征数据的bit位 一般8就ok了
    m = KerasModel(model,
                   model.input,
                   None,
                   logits,
                   None,
                   bounds=(0, 255.0),
                   channel_axis=3,
                   preprocess=([104, 116, 123], 1),
                   featurefqueezing_bit_depth=8)

    attack = FGSM(m)
    #设置epsilons时不用考虑特征范围 算法实现时已经考虑了取值范围的问题 epsilons取值范围为(0,1)
    #epsilon支持动态调整 epsilon_steps为epsilon变化的个数
    #epsilons为下限 epsilons_max为上限
    #attack_config = {"epsilons": 0.3, "epsilons_max": 0.5, "epsilon_steps": 100}
    #静态epsilons
    attack_config = {
        "epsilons": 1,
        "epsilons_max": 10,
        "epsilon_steps": 1,
        "steps": 100
    }

    #y设置为空 会自动计算
    adversary = Adversary(imagedata.copy(), None)

    # FGSM non-targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)

        logging.info("adversary_image label={0} ".format(
            np.argmax(m.predict(adversary_image))))
        #logging.info(adversary_image)

        #强制类型转换 之前是float 现在要转换成uint8
        adversary_image = np.array(adversary_image).astype("uint8").reshape(
            [224, 224, 3])

        #logging.info(adversary_image)
        adversary_image = adversary_image[:, :, ::-1]
        logging.info(adversary_image - raw_imagedata)

        img = array_to_img(adversary_image)
        img.save('adversary_image_nontarget.jpg')

    print("fgsm non-target attack done")

    attack = FGSMT(m)
    #静态epsilons
    attack_config = {
        "epsilons": 10,
        "epsilons_max": 10,
        "epsilon_steps": 1,
        "steps": 100
    }

    adversary = Adversary(imagedata, None)

    tlabel = 489
    adversary.set_target(is_targeted_attack=True, target_label=tlabel)

    # FGSM targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)
        #强制类型转换 之前是float 现在要转换成int8

        adversary_image = np.array(adversary_image).astype("uint8").reshape(
            [224, 224, 3])

        adversary_image = adversary_image[:, :, ::-1]
        logging.info(adversary_image - raw_imagedata)

        img = array_to_img(adversary_image)
        img.save('adversary_image_target.jpg')

    print("fgsm target attack done")
def main(use_cuda):
    """
    Advbox demo which demonstrate how to use advbox.
    """
    class_dim = 1000
    IMG_NAME = 'img'
    LABEL_NAME = 'label'
    #模型路径 http://paddle-imagenet-models.bj.bcebos.com/resnet_50_model.tar 下载并解压
    #pretrained_model = "models/resnet_50/115"
    pretrained_model = "models/alexnet/116/"
    image_shape = [3, 224, 224]

    image = fluid.layers.data(name=IMG_NAME,
                              shape=image_shape,
                              dtype='float32')
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')

    # model definition

    model = AlexNet()

    out = model.net(input=image, class_dim=class_dim)

    # 根据配置选择使用CPU资源还是GPU资源
    place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace()
    exe = fluid.Executor(place)

    #加载模型参数
    if pretrained_model:

        def if_exist(var):
            return os.path.exists(os.path.join(pretrained_model, var.name))

        logger.info("Load pretrained_model")
        fluid.io.load_vars(exe, pretrained_model, predicate=if_exist)

    cost = fluid.layers.cross_entropy(input=out, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    logging.info("Build advbox")
    # advbox demo 黑盒攻击 直接传入测试版本的program
    m = PaddleBlackBoxModel(fluid.default_main_program().clone(for_test=True),
                            IMG_NAME,
                            LABEL_NAME,
                            out.name, (-1, 1),
                            channel_axis=0)

    #不定向攻击
    # 形状为[1,28,28] channel_axis=0  形状为[28,28,1] channel_axis=2
    attack = LocalSearchAttack(m)

    attack_config = {"R": 200, "r": 1.0}

    test_data = get_image("cat.jpg")
    original_data = np.copy(test_data)
    # 猫对应的标签 imagenet 2012 对应链接https://blog.csdn.net/LegenDavid/article/details/73335578
    original_label = None
    adversary = Adversary(original_data, original_label)

    logger.info("Non-targeted Attack...")
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():

        print('attack success, original_label=%d, adversarial_label=%d' %
              (adversary.original_label, adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)

        #从[3,224,224]转换成[224,224,3]
        adversary_image *= img_std
        adversary_image += img_mean

        adversary_image = np.array(adversary_image *
                                   255).astype("uint8").transpose([1, 2, 0])

        im = Image.fromarray(adversary_image)
        im.save("adversary_image.jpg")

    else:
        print('attack failed, original_label=%d' % (adversary.original_label))

    logger.info("LocalSearchAttack attack done")
Пример #10
0
def main(dirname):
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 500

    mnist = input_data.read_data_sets("MNIST_data/", one_hot=False)

    x = tf.placeholder(tf.float32, [None, 784])

    y_ = tf.placeholder(tf.int64, [None])

    #keep_prob = tf.placeholder(tf.float32)
    keep_prob = 1.0

    logits = mnist_cnn_model(x, keep_prob)

    cross_entropy = tf.losses.sparse_softmax_cross_entropy(labels=y_,
                                                           logits=logits)
    cross_entropy = tf.reduce_mean(cross_entropy)

    BATCH_SIZE = 1

    # advbox demo
    m = TensorflowModel(dirname,
                        x,
                        cross_entropy,
                        logits, (-1, 1),
                        channel_axis=1)
    attack = FGSM(m)
    attack_config = {"epsilons": 0.3}

    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0

    for _ in range(10000):
        data = mnist.test.next_batch(BATCH_SIZE, shuffle=False)

        total_count += 1
        (x, y) = data

        y = y[0]

        #print(x.shape)
        #print(y.shape)

        adversary = Adversary(x, y)

        # FGSM non-targeted attack
        adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (y, adversary.adversarial_label, total_count))

        else:
            print('attack failed, original_label=%d, count=%d' %
                  (y, total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break

    print("fgsm attack done")
Пример #11
0
def main(use_cuda):
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 500
    IMG_NAME = 'image'
    LABEL_NAME = 'label'

    weight_file = "fluid/lenet/lenet.npy"

    #1, define network topology
    images = fluid.layers.data(name=IMG_NAME,
                               shape=[1, 28, 28],
                               dtype='float32')
    # gradient should flow
    images.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')

    net = LeNet({'data': images})
    prediction = net.layers['prob']

    cost = fluid.layers.cross_entropy(input=prediction, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    #根据配置选择使用CPU资源还是GPU资源
    place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace()

    exe = fluid.Executor(place)
    #这句很关键 没有的话会报错
    # AttributeError: 'NoneType' object has no attribute 'get_tensor'
    exe.run(fluid.default_startup_program())

    #加载参数
    net.load(data_path=weight_file, exe=exe, place=place)

    BATCH_SIZE = 1

    test_reader = paddle.batch(paddle.reader.shuffle(
        paddle.dataset.mnist.test(), buf_size=128 * 10),
                               batch_size=BATCH_SIZE)

    # advbox demo
    m = PaddleModel(fluid.default_main_program(),
                    IMG_NAME,
                    LABEL_NAME,
                    prediction.name,
                    avg_cost.name, (-1, 1),
                    channel_axis=1)
    attack = FGSM(m)
    # attack = FGSMT(m)
    attack_config = {"epsilons": 0.3}

    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        adversary = Adversary(data[0][0], data[0][1])

        # FGSM non-targeted attack
        adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (data[0][1], adversary.adversarial_label, total_count))

        else:
            print('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("fgsm attack done")
Пример #12
0
def main():
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 10
    pretrained_model = "./cifar-pytorch/net.pth"

    loss_func = torch.nn.CrossEntropyLoss()

    test_loader = torch.utils.data.DataLoader(datasets.CIFAR10(
        './cifar-pytorch/data',
        train=False,
        download=True,
        transform=transforms.Compose([
            transforms.ToTensor(),
        ])),
                                              batch_size=1,
                                              shuffle=False)

    # Define what device we are using
    logging.info("CUDA Available: {}".format(torch.cuda.is_available()))
    device = torch.device("cuda" if torch.cuda.is_available() else "cpu")

    # Initialize the network
    model = Net().to(device)

    # Load the pretrained model
    model.load_state_dict(torch.load(pretrained_model, map_location='cpu'))

    # Set the model in evaluation mode. In this case this is for the Dropout layers
    model.eval()

    attack_config = {
        "epsilons": 0.005,
        "epsilon_steps": 40,
        "epsilons_max": 0.2,
        "norm_ord": 1,
        "steps": 100
    }
    print(attack_config)
    for idx in [-10, -5, -2, -1, 0, 1, 2, 5, 10]:
        print('grad_conf:', idx)

        # advbox demo
        m = PytorchModel(model,
                         loss_func, (0, 1),
                         channel_axis=1,
                         grad_conf=idx)
        attack = FGSM(m)

        # use test data to generate adversarial examples
        total_count = 0
        fooling_count = 0
        m_dists = []
        e_dists = []
        for i, data in enumerate(test_loader):
            inputs, labels = data

            #inputs, labels = inputs.to(device), labels.to(device)
            inputs, labels = inputs.numpy(), labels.numpy()

            #inputs.requires_grad = True
            #print(inputs.shape)

            total_count += 1
            adversary = Adversary(inputs, labels[0])

            # FGSM non-targeted attack
            adversary = attack(adversary, **attack_config)

            if adversary.is_successful():
                fooling_count += 1
                # print(
                #     'attack success, original_label=%d, adversarial_label=%d, count=%d'
                #     % (labels, adversary.adversarial_label, total_count))
                m_dist = mahalanobis_dist(adversary.original,
                                          adversary.adversarial_example)
                e_dist = eu_dist(adversary.original,
                                 adversary.adversarial_example)
                m_dists = m_dists + [m_dist]
                e_dists = e_dists + [e_dist]

            # else:
            #     print('attack failed, original_label=%d, count=%d' %
            #         (labels, total_count))

            if total_count >= TOTAL_NUM:
                print(
                    "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                    % (fooling_count, total_count,
                       float(fooling_count) / total_count))
                print("mahalanobis_dist:", np.mean(m_dists))
                print("eu_dist", np.mean(e_dists))
                break
        print("done")
    print('all done')
Пример #13
0
def main(modulename, imagename):
    '''
    Kera的应用模块Application提供了带有预训练权重的Keras模型,这些模型可以用来进行预测、特征提取和finetune
    模型的预训练权重将下载到~/.keras/models/并在载入模型时自动载入
    '''

    # 设置为测试模式
    keras.backend.set_learning_phase(0)

    model = ResNet50(weights=modulename)

    img = image.load_img(imagename, target_size=(224, 224))
    original_image = image.img_to_array(img)
    imagedata = np.expand_dims(original_image, axis=0)

    #获取logit层
    logits = model.get_layer('fc1000').output

    # 创建keras对象
    # imagenet数据集归一化时 标准差为1  mean为[104, 116, 123]
    m = KerasModel(model,
                   model.input,
                   None,
                   logits,
                   None,
                   bounds=(0, 255),
                   channel_axis=3,
                   preprocess=([104, 116, 123], 1),
                   featurefqueezing_bit_depth=8)

    attack = FGSM(m)
    #静态epsilon
    attack_config = {
        "epsilons": 1,
        "epsilons_max": 10,
        "epsilon_steps": 1,
        "steps": 100
    }

    #y设置为空 会自动计算
    adversary = Adversary(imagedata[:, :, ::-1], None)

    # fgsm non-targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        adversary_image = np.copy(adversary.adversarial_example)
        #强制类型转换 之前是float 现在要转换成uint8

        #BGR -> RGB
        adversary_image = adversary_image[:, :, ::-1]

        #adversary_image = np.array(adversary_image).astype("uint8").reshape([224,224,3])
        #original_image=np.array(original_image).astype("uint8").reshape([224, 224, 3])

        adversary_image = np.array(adversary_image).reshape([224, 224, 3])
        original_image = np.array(original_image).reshape([224, 224, 3])

        show_images_diff(original_image, adversary_image)

    print("FGSM non-target attack done")
def main(dirname, imagename):

    #加载解码的图像 这里是个大坑 tf提供的imagenet预训练好的模型pb文件中 包含针对图像的预处理环节 即解码jpg文件 这部分没有梯度
    #需要直接处理解码后的数据
    image = None
    with tf.gfile.Open(imagename, 'rb') as f:
        image = np.array(Image.open(f).convert('RGB')).astype(np.float)

    image = [image]

    session = tf.Session()

    def create_graph(dirname):
        with tf.gfile.FastGFile(dirname, 'rb') as f:
            graph_def = session.graph_def
            graph_def.ParseFromString(f.read())

            _ = tf.import_graph_def(graph_def, name='')

    create_graph(dirname)

    # 初始化参数  非常重要
    session.run(tf.global_variables_initializer())

    tensorlist = [n.name for n in session.graph_def.node]

    logger.info(tensorlist)

    #获取logits
    logits = session.graph.get_tensor_by_name('softmax/logits:0')

    x = session.graph.get_tensor_by_name('ExpandDims:0')

    #y = tf.placeholder(tf.int64, None, name='label')

    # advbox demo
    # 因为原始数据没有归一化  所以bounds=(0, 255)
    m = TensorflowPBModel(session,
                          x,
                          None,
                          logits,
                          None,
                          bounds=(0, 255),
                          channel_axis=3,
                          preprocess=None)

    attack = DeepFoolAttack(m)
    attack_config = {"iterations": 100, "overshoot": 0.02}

    #y设置为空 会自动计算
    adversary = Adversary(image, None)

    # FGSM non-targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)

        #print(adversary_image - image)

        #强制类型转换 之前是float 现在要转换成int8
        adversary_image = np.array(adversary_image).astype("uint8").reshape(
            [100, 100, 3])

        logging.info(adversary_image - image)
        #print(adversary_image - image)

        im = Image.fromarray(adversary_image)
        im.save("adversary_image_nontarget.jpg")

    print("DeepFool non-target attack done")

    attack = DeepFoolAttack(m)
    attack_config = {"iterations": 100, "overshoot": 0.05}

    adversary = Adversary(image, None)
    #麦克风
    tlabel = 651
    adversary.set_target(is_targeted_attack=True, target_label=tlabel)

    # FGSM targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)
        #强制类型转换 之前是float 现在要转换成int8

        logging.info(adversary_image - image)

        adversary_image = np.array(adversary_image).astype("uint8").reshape(
            [100, 100, 3])
        im = Image.fromarray(adversary_image)
        im.save("adversary_image_target.jpg")

    print("DeepFool target attack done")
def main(modulename, imagename):
    '''
    Kera的应用模块Application提供了带有预训练权重的Keras模型,这些模型可以用来进行预测、特征提取和finetune
    模型的预训练权重将下载到~/.keras/models/并在载入模型时自动载入
    '''

    # 设置为测试模式
    keras.backend.set_learning_phase(0)

    model = ResNet50(weights=modulename)

    logging.info(model.summary())

    img = image.load_img(imagename, target_size=(224, 224))
    imagedata = image.img_to_array(img)
    #imagedata=imagedata[:, :, ::-1]
    imagedata = np.expand_dims(imagedata, axis=0)

    #logit fc1000
    logits = model.get_layer('fc1000').output

    #keras中获取指定层的方法为:
    #base_model.get_layer('block4_pool').output)
    # advbox demo
    # 因为原始数据没有归一化  所以bounds=(0, 255)  KerasMode内部在进行预测和计算梯度时会进行预处理
    # imagenet数据集归一化时 标准差为1  mean为[104, 116, 123]
    m = KerasModel(model,
                   model.input,
                   None,
                   logits,
                   None,
                   bounds=(0, 255),
                   channel_axis=3,
                   preprocess=([104, 116, 123], 1),
                   featurefqueezing_bit_depth=8)

    attack = DeepFoolAttack(m)
    attack_config = {"iterations": 100, "overshoot": 10}

    #y设置为空 会自动计算
    adversary = Adversary(imagedata[:, :, ::-1], None)

    # deepfool non-targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)
        #强制类型转换 之前是float 现在要转换成iunt8

        #::-1 reverses the color channels, because Keras ResNet50 expects BGR instead of RGB
        adversary_image = adversary_image[:, :, ::-1]

        adversary_image = np.array(adversary_image).astype("uint8").reshape(
            [224, 224, 3])

        logging.info(adversary_image - imagedata)
        img = array_to_img(adversary_image)
        img.save('adversary_image_nontarget.jpg')

    print("deepfool non-target attack done")

    attack = DeepFoolAttack(m)
    attack_config = {"iterations": 100, "overshoot": 10}

    adversary = Adversary(imagedata[:, :, ::-1], None)

    tlabel = 489
    adversary.set_target(is_targeted_attack=True, target_label=tlabel)

    # deepfool targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)
        #强制类型转换 之前是float 现在要转换成int8

        #::-1 reverses the color channels, because Keras ResNet50 expects BGR instead of RGB
        adversary_image = adversary_image[:, :, ::-1]

        adversary_image = np.array(adversary_image).astype("uint8").reshape(
            [224, 224, 3])

        logging.info(adversary_image - imagedata)
        img = array_to_img(adversary_image)
        img.save('adversary_image_target.jpg')

    print("deepfool target attack done")
Пример #16
0
def main(modulename, imagename):
    '''
    Kera的应用模块Application提供了带有预训练权重的Keras模型,这些模型可以用来进行预测、特征提取和finetune
    模型的预训练权重将下载到~/.keras/models/并在载入模型时自动载入
    '''

    # 设置为测试模式
    keras.backend.set_learning_phase(0)

    model = ResNet50(weights=modulename)

    logging.info(model.summary())

    img = image.load_img(imagename, target_size=(224, 224))
    imagedata = image.img_to_array(img)
    imagedata = np.expand_dims(imagedata, axis=0)
    #keras数据预处理后范围为(-128,128)
    imagedata = preprocess_input(imagedata)

    preds = model.predict(imagedata)

    #logit fc1000
    logits = model.get_layer('fc1000').output

    print('Predicted:', decode_predictions(preds, top=3)[0])

    #keras中获取指定层的方法为:
    #base_model.get_layer('block4_pool').output)

    # advbox demo
    # 因为原始数据没有归一化  所以bounds=(0, 255)
    m = KerasModel(model,
                   model.input,
                   None,
                   logits,
                   None,
                   bounds=(-128, 128),
                   channel_axis=3,
                   preprocess=None)

    attack = FGSM(m)
    #设置epsilons时不用考虑特征范围 算法实现时已经考虑了取值范围的问题 epsilons取值范围为(0,1)
    #epsilon支持动态调整 epsilon_steps为epsilon变化的个数
    #epsilons为下限 epsilons_max为上限
    attack_config = {
        "epsilons": 0.1,
        "epsilons_max": 0.5,
        "epsilon_steps": 100
    }

    #y设置为空 会自动计算
    adversary = Adversary(imagedata, None)

    # FGSM non-targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():
        print('attack success, adversarial_label=%d' %
              (adversary.adversarial_label))

        #对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)
        #强制类型转换 之前是float 现在要转换成int8
        #print(adversary_image)
        adversary_image = np.array(adversary_image).astype("int8").reshape(
            [224, 224, 3])

        #logging.info(adversary_image-imagedata)
        #logging.info(adversary_image)

        im = Image.fromarray(adversary_image)
        im.save("adversary_image_nontarget.jpg")

    print("fgsm non-target attack done")
Пример #17
0
def main(use_cuda):
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 500
    IMG_NAME = 'img'
    LABEL_NAME = 'label'

    img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32')
    # gradient should flow
    img.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')
    logits = mnist_cnn_model(img)
    cost = fluid.layers.cross_entropy(input=logits, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    #根据配置选择使用CPU资源还是GPU资源
    place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace()
    exe = fluid.Executor(place)

    BATCH_SIZE = 1

    test_reader = paddle.batch(
        paddle.reader.shuffle(
            paddle.dataset.mnist.test(), buf_size=128 * 10),
        batch_size=BATCH_SIZE)

    fluid.io.load_params(
        exe, "./mnist/", main_program=fluid.default_main_program())

    # advbox demo
    m = PaddleModel(
        fluid.default_main_program(),
        IMG_NAME,
        LABEL_NAME,
        logits.name,
        avg_cost.name, (-1, 1),
        channel_axis=1)
    #使用静态FGSM epsilon不可变
    attack = FGSM_static(m)
    attack_config = {"epsilon": 0.01}

    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        adversary = Adversary(data[0][0], data[0][1])

        # FGSM non-targeted attack
        adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            #print(
            #    'attack success, original_label=%d, adversarial_label=%d, count=%d'
            #    % (data[0][1], adversary.adversarial_label, total_count))
        else:
            logger.info('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("fgsm attack done without any defence")

    #使用FeatureFqueezingDefence

    # advbox FeatureFqueezingDefence demo

    n = PaddleFeatureFqueezingDefenceModel(
        fluid.default_main_program(),
        IMG_NAME,
        LABEL_NAME,
        logits.name,
        avg_cost.name, (-1, 1),
        channel_axis=1,preprocess=None,
        bit_depth=1,
        clip_values=(-1, 1)
            )
    attack_new = FGSM_static(n)
    attack_config = {"epsilon": 0.01}

    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1

        #不设置y 会自动获取
        adversary = Adversary(data[0][0], None)

        # FGSM non-targeted attack
        adversary = attack_new(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            logger.info(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                    % (data[0][1], adversary.adversarial_label, total_count)
            )
        else:
            logger.info('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("fgsm attack done with FeatureFqueezingDefence")
Пример #18
0
def main():
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 5
    pretrained_model = "./mnist-pytorch/net.pth"

    loss_func = torch.nn.CrossEntropyLoss()

    test_loader = torch.utils.data.DataLoader(datasets.MNIST(
        './mnist-pytorch/data',
        train=False,
        download=True,
        transform=transforms.Compose([
            transforms.ToTensor(),
        ])),
                                              batch_size=1,
                                              shuffle=False)

    # Define what device we are using
    logging.info("CUDA Available: {}".format(torch.cuda.is_available()))
    device = torch.device("cuda" if torch.cuda.is_available() else "cpu")

    # Initialize the network
    model = Net().to(device)

    # Load the pretrained model
    model.load_state_dict(torch.load(pretrained_model, map_location='cpu'))

    # Set the model in evaluation mode. In this case this is for the Dropout layers
    model.eval()

    # advbox demo
    m = PytorchModel(model, loss_func, (0, 1), channel_axis=1)
    attack = BIM(m)

    attack_config = {
        "epsilons": 0.05,
        "epsilon_steps": 1,
        "epsilons_max": 0.05,
        "norm_ord": 1,
        "steps": 10
    }

    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for i, data in enumerate(test_loader):
        inputs, labels = data

        #inputs, labels = inputs.to(device), labels.to(device)
        inputs, labels = inputs.numpy(), labels.numpy()

        #inputs.requires_grad = True
        #print(inputs.shape)

        total_count += 1
        adversary = Adversary(inputs, labels[0])

        # FGSM non-targeted attack
        adversary = attack(adversary, **attack_config)
        print(adversary.original.shape)
        pertubation = adversary.perturbation()  # (1,1,28,28)
        m_dist = mahalanobis_dist(adversary.original,
                                  adversary.adversarial_example)
        e_dist = eu_dist(adversary.original, adversary.adversarial_example)
        print('###')
        print(m_dist)
        print(e_dist)
        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (labels, adversary.adversarial_label, total_count))

        else:
            print('attack failed, original_label=%d, count=%d' %
                  (labels, total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("fgsm attack done")
def main(use_cuda):
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 500
    IMG_NAME = 'img'
    LABEL_NAME = 'label'

    img = fluid.layers.data(name=IMG_NAME, shape=[3, 32, 32], dtype='float32')
    # gradient should flow
    img.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')
    logits = resnet_cifar10(img, 32)
    cost = fluid.layers.cross_entropy(input=logits, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    #根据配置选择使用CPU资源还是GPU资源
    place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace()

    exe = fluid.Executor(place)

    BATCH_SIZE = 1

    test_reader = paddle.batch(paddle.reader.shuffle(
        paddle.dataset.cifar.test10(), buf_size=128 * 10),
                               batch_size=BATCH_SIZE)

    fluid.io.load_params(exe,
                         "cifar10/resnet/",
                         main_program=fluid.default_main_program())

    # advbox demo
    m = PaddleModel(fluid.default_main_program(),
                    IMG_NAME,
                    LABEL_NAME,
                    logits.name,
                    avg_cost.name, (0, 255),
                    channel_axis=0)

    #形状为[1,28,28] channel_axis=0  形状为[28,28,1] channel_axis=2
    attack = SinglePixelAttack(m)

    attack_config = {"max_pixels": 32 * 32}

    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        img = data[0][0]
        img = np.reshape(img, [3, 32, 32])

        adversary = Adversary(img, data[0][1])
        #adversary = Adversary(data[0][0], data[0][1])

        # SinglePixelAttack non-targeted attack
        adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (data[0][1], adversary.adversarial_label, total_count))
        else:
            print('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("SinglePixelAttack attack done")
Пример #20
0
def main(use_cuda):
    """
    Advbox example which demonstrate how to use advbox.
    """
    # base marco
    TOTAL_NUM = 100
    IMG_NAME = 'image'
    LABEL_NAME = 'label'

    # parse args
    args = parser.parse_args()
    print_arguments(args)

    # parameters from arguments
    class_dim = args.class_dim
    model_name = args.model
    target_class = args.target
    pretrained_model = args.pretrained_model
    image_shape = [int(m) for m in args.image_shape.split(",")]
    if args.log_debug:
        logging.getLogger().setLevel(logging.INFO)

    assert model_name in model_list, "{} is not in lists: {}".format(
        args.model, model_list)

    # model definition
    model = models.__dict__[model_name]()
    # declare vars
    image = fluid.layers.data(name=IMG_NAME,
                              shape=image_shape,
                              dtype='float32')
    logits = model.net(input=image, class_dim=class_dim)

    # clone program and graph for inference
    infer_program = fluid.default_main_program().clone(for_test=True)

    image.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')
    cost = fluid.layers.cross_entropy(input=logits, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    BATCH_SIZE = 1
    test_reader = paddle.batch(reader.test(TEST_LIST, DATA_PATH),
                               batch_size=BATCH_SIZE)

    # advbox demo
    m = PaddleModel(fluid.default_main_program(),
                    IMG_NAME,
                    LABEL_NAME,
                    logits.name,
                    avg_cost.name, (0, 1),
                    channel_axis=3)
    # Adversarial method: FGSM
    attack = FGSM(m)
    attack_config = {"epsilons": 0.03}

    enable_gpu = use_cuda and args.use_gpu
    place = fluid.CUDAPlace(0) if enable_gpu else fluid.CPUPlace()
    exe = fluid.Executor(place)
    exe.run(fluid.default_startup_program())

    # reload model vars
    if pretrained_model:

        def if_exist(var):
            return os.path.exists(os.path.join(pretrained_model, var.name))

        fluid.io.load_vars(exe, pretrained_model, predicate=if_exist)

    # inference
    pred_label = infer(infer_program, image, logits, place, exe)
    # if only inference ,and exit
    if args.inference:
        exit(0)

    print("--------------------adversary-------------------")
    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        data_img = [data[0][0]]
        filename = data[0][1]
        org_data = data_img[0][0]
        adversary = Adversary(org_data, pred_label[filename])
        #target attack
        if target_class != -1:
            tlabel = target_class
            adversary.set_target(is_targeted_attack=True, target_label=tlabel)

        adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (pred_label[filename], adversary.adversarial_label,
                   total_count))
            #output original image, adversarial image and difference image
            generation_image(total_count, org_data, pred_label[filename],
                             adversary.adversarial_example,
                             adversary.adversarial_label, "FGSM")
        else:
            print('attack failed, original_label=%d, count=%d' %
                  (pred_label[filename], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    # inference
    pred_label2 = infer(infer_program, image, logits, place, exe)

    print("fgsm attack done")
Пример #21
0
def main():
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 500
    IMG_NAME = 'img'
    LABEL_NAME = 'label'

    img = fluid.layers.data(name=IMG_NAME, shape=[1, 28, 28], dtype='float32')
    # gradient should flow
    img.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')
    logits = mnist_cnn_model(img)
    cost = fluid.layers.cross_entropy(input=logits, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    # use CPU
    place = fluid.CPUPlace()
    # use GPU
    # place = fluid.CUDAPlace(0)
    exe = fluid.Executor(place)

    BATCH_SIZE = 1
    train_reader = paddle.batch(paddle.reader.shuffle(
        paddle.dataset.mnist.train(), buf_size=128 * 10),
                                batch_size=BATCH_SIZE)

    test_reader = paddle.batch(paddle.reader.shuffle(
        paddle.dataset.mnist.test(), buf_size=128 * 10),
                               batch_size=BATCH_SIZE)

    fluid.io.load_params(exe,
                         "./mnist/",
                         main_program=fluid.default_main_program())

    # advbox demo
    m = PaddleModel(fluid.default_main_program(),
                    IMG_NAME,
                    LABEL_NAME,
                    logits.name,
                    avg_cost.name, (-1, 1),
                    channel_axis=1)
    attack = DeepFoolAttack(m)
    attack_config = {"iterations": 100, "overshoot": 9}

    # use train data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in train_reader():
        total_count += 1
        adversary = Adversary(data[0][0], data[0][1])

        # DeepFool non-targeted attack
        adversary = attack(adversary, **attack_config)

        # DeepFool targeted attack
        # tlabel = 0
        # adversary.set_target(is_targeted_attack=True, target_label=tlabel)
        # adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (data[0][1], adversary.adversarial_label, total_count))
            # plt.imshow(adversary.target, cmap='Greys_r')
            # plt.show()
            # np.save('adv_img', adversary.target)
        else:
            print('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TRAIN_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break

    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        adversary = Adversary(data[0][0], data[0][1])

        # DeepFool non-targeted attack
        adversary = attack(adversary, **attack_config)

        # DeepFool targeted attack
        # tlabel = 0
        # adversary.set_target(is_targeted_attack=True, target_label=tlabel)
        # adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (data[0][1], adversary.adversarial_label, total_count))
            # plt.imshow(adversary.target, cmap='Greys_r')
            # plt.show()
            # np.save('adv_img', adversary.target)
        else:
            print('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    print("deelfool attack done")
def main(use_cuda):
    """
    Advbox demo which demonstrate how to use advbox.
    """
    TOTAL_NUM = 500
    IMG_NAME = 'img'
    LABEL_NAME = 'label'

    img = fluid.layers.data(name=IMG_NAME, shape=[3, 32, 32], dtype='float32')
    # gradient should flow
    img.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')

    # logits = mnist_cnn_model(img)
    # logits = vgg_bn_drop(img)
    logits = resnet_cifar10(img, 32)

    cost = fluid.layers.cross_entropy(input=logits, label=label)
    avg_cost = fluid.layers.mean(x=cost)

    #根据配置选择使用CPU资源还是GPU资源
    place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace()
    exe = fluid.Executor(place)

    BATCH_SIZE = 1
    test_reader = paddle.batch(paddle.dataset.cifar.test10(),
                               batch_size=BATCH_SIZE)

    fluid.io.load_params(exe,
                         "cifar10/resnet",
                         main_program=fluid.default_main_program())

    # advbox demo
    m = PaddleModel(fluid.default_main_program(),
                    IMG_NAME,
                    LABEL_NAME,
                    logits.name,
                    avg_cost.name, (-1, 1),
                    channel_axis=1)
    # attack = FGSM(m)
    attack = DeepFoolAttack(m)
    # attack = FGSMT(m)
    # attack_config = {"epsilons": 0.3}
    attack_config = {"iterations": 100, "overshoot": 9}
    # use test data to generate adversarial examples
    total_count = 0
    fooling_count = 0
    for data in test_reader():
        total_count += 1
        adversary = Adversary(data[0][0], data[0][1])

        # FGSM non-targeted attack
        adversary = attack(adversary, **attack_config)

        # FGSMT targeted attack
        # tlabel = 0
        # adversary.set_target(is_targeted_attack=True, target_label=tlabel)
        # adversary = attack(adversary, **attack_config)

        if adversary.is_successful():
            fooling_count += 1
            print(
                'attack success, original_label=%d, adversarial_label=%d, count=%d'
                % (data[0][1], adversary.adversarial_label, total_count))
            # plt.imshow(adversary.target, cmap='Greys_r')
            # plt.show()
            # np.save('adv_img', adversary.target)
        else:
            print('attack failed, original_label=%d, count=%d' %
                  (data[0][1], total_count))

        if total_count >= TOTAL_NUM:
            print(
                "[TEST_DATASET]: fooling_count=%d, total_count=%d, fooling_rate=%f"
                % (fooling_count, total_count,
                   float(fooling_count) / total_count))
            break
    # print("fgsm attack done")
    print("deelfool attack done")
Пример #23
0
def main():

    assert 0 <= options.r <= 2
    assert options.c in [0, 1, 2, 3]
    assert options.m in ["onnx", "tersorflow"]

    print("options:{}".format(options))

    if options.m == "onnx":
        m = graphpipeBlackBoxModel_onnx(options.url, (0, 255),
                                        channel_axis=options.c)

    else:
        m = graphpipeBlackBoxModel(options.url, (0, 255),
                                   channel_axis=options.c)

    start = time.time()

    # 不定向攻击
    attack = LocalSearchAttack(m)

    # R 攻击次数
    # r p 绕定系数
    # t 每次攻击的点数
    # d 搜索半径
    attack_config = {
        "R": options.R,
        "r": options.r,
        "p": options.p,
        "t": options.t,
        "d": options.d
    }

    data = np.array(Image.open(options.input_file))
    data = data.reshape([1] + list(data.shape))
    data = np.rollaxis(data, 3, 1).astype(np.float32)  # channels first
    print("Image shape :{}".format(data.shape))

    original_data = np.copy(data)
    # 猫对应的标签 imagenet 2012 对应链接https://blog.csdn.net/LegenDavid/article/details/73335578
    original_label = None
    adversary = Adversary(original_data, original_label)

    print("Non-targeted Attack...")
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():

        print('attack success, original_label=%d, adversarial_label=%d' %
              (adversary.original_label, adversary.adversarial_label))

        # 对抗样本保存在adversary.adversarial_example
        adversary_image = np.copy(adversary.adversarial_example)

        adversary_image = np.array(
            adversary_image[0]).astype("uint8").transpose([1, 2, 0])

        im = Image.fromarray(adversary_image)
        im.save(options.output_file)

        print("Save file :{}".format(options.output_file))

        show_images_diff(options.input_file, options.output_file)

    else:
        print('attack failed, original_label=%d' % (adversary.original_label))

    end = time.time()
    print("LocalSearchAttack attack done. Cost time {}s".format(end - start))
Пример #24
0
def main(use_cuda):
    """
    Advbox demo which demonstrate how to use advbox.
    """
    class_dim = 1000
    IMG_NAME = 'img'
    LABEL_NAME = 'label'
    #模型路径
    pretrained_model = "models/resnet_50/115"
    with_memory_optimization = 1
    image_shape = [3,224,224]

    image = fluid.layers.data(name=IMG_NAME, shape=image_shape, dtype='float32')
    # gradient should flow
    image.stop_gradient = False
    label = fluid.layers.data(name=LABEL_NAME, shape=[1], dtype='int64')

    # model definition

    model = resnet.ResNet50()

    out = model.net(input=image, class_dim=class_dim)

    #test_program = fluid.default_main_program().clone(for_test=True)

    if with_memory_optimization:
        fluid.memory_optimize(fluid.default_main_program())

    # 根据配置选择使用CPU资源还是GPU资源
    place = fluid.CUDAPlace(0) if use_cuda else fluid.CPUPlace()
    exe = fluid.Executor(place)
    exe.run(fluid.default_startup_program())

    #加载模型参数
    if pretrained_model:

        def if_exist(var):
            return os.path.exists(os.path.join(pretrained_model, var.name))

        fluid.io.load_vars(exe, pretrained_model, predicate=if_exist)


    cost = fluid.layers.cross_entropy(input=out, label=label)
    avg_cost = fluid.layers.mean(x=cost)


    # advbox demo
    m = PaddleModel(
        fluid.default_main_program(),
        IMG_NAME,
        LABEL_NAME,
        out.name,
        avg_cost.name, (-1, 1),
        channel_axis=3)
    attack = FGSM(m)

    attack_config = {"epsilons": 0.3}

    test_data = get_image("cat.jpg")
    # 猫对应的标签
    test_label = 285

    adversary = Adversary(test_data, test_label)

    # FGSM non-targeted attack
    adversary = attack(adversary, **attack_config)

    if adversary.is_successful():

        print(
                'attack success, original_label=%d, adversarial_label=%d'
                % (test_label, adversary.adversarial_label))

    else:
        print('attack failed, original_label=%d, ' % (test_label))

    print("fgsm attack done")